Skip to content

Conversation

@adamb70
Copy link

@adamb70 adamb70 commented Feb 4, 2020

As per markedjs/marked#1519, markedjs is deprecating their sanitizer options. EasyMDE currently doesn't allow any other options for sanitizing the markdown preview.

They are suggesting using an external sanitization library such as DOMPurify (recommended), sanitize-html or insane. As they have slightly different API's for handling their options I suggest simply providing the option to wrap the markedjs HTML output in a custom sanitizer function, which can accommodate any external library.

function(renderedHTML) {
	// Using DOMPurify with options
	return DOMPurify.sanitize(renderedHTML, {ALLOWED_TAGS: ['b']})
}

@adamb70 adamb70 marked this pull request as ready for review February 4, 2020 13:51
Copy link
Owner

@Ionaru Ionaru left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good, can you add this to the changelog as well?

@A-312
Copy link

A-312 commented Mar 2, 2020

@Ionaru done

@Ionaru
Copy link
Owner

Ionaru commented Mar 4, 2020

Does the typeof check work with arrow functions as well?

const sanitizer = () => ...;

@Ionaru
Copy link
Owner

Ionaru commented Mar 4, 2020

Tested, it should work.

@Ionaru Ionaru merged commit 84ea2c2 into Ionaru:master Mar 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants